Indistinguishable from Jesse

Firefox 1.5 has been released! If you've been using Firefox 1.5 Release Candidate 3, congratulations: you already have Firefox 1.5.

Power users upgrading from Firefox 1.0.7 will appreciate draggable tabs, a much faster Back button, and the replacement of many error dialogs with error pages. Web developers and can now take advantage of SVG, Canvas, E4X, and several new CSS selectors and properties. See the release notes or my detailed changelog for more about what's new.

Firefox 1.5 also includes a number of security fixes, as well as architectural changes that should reduce the number of security holes without us having to enumerate the holes. These changes can also be thought of as making it easier to write code that doesn't contain security holes. For example, XPCNativeWrappers, which isolate JavaScript in extensions and Firefox itself from JavaScript in web pages they manipulate, have been improved and turned on by default for extensions.

Equally important for security is an overhaul to the software update system. From now on, security updates will be small binary patches, usually between 200KB and 500KB. These updates can be installed with one click, in contrast to using the new version's installer (like you would to update from Firefox 1.0.6 to Firefox 1.0.7). Update notification has also been improved; the subtle red button in the menu bar has been replaced with a dialog. The result of these changes is that it's now much easier to keep your copy of Firefox up to date.

For an idea of the size of updates, the update from Firefox 1.5 RC2 to RC3 (fixing two bugs) on Windows was 218K, while the update from RC1 to RC2 (fixing about ten bugs) was 390K. Major updates, such as the update from Firefox 1.5.0.x to Firefox 2.0, will likely be bigger but I don't know how much bigger. The binary patch system is based on bsdiff; you can read about the algorithm if you're interested.

This entry was posted on Tuesday, November 29th, 2005 at 4:34 pm and is filed under Mozilla, Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.